<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>linux网络相关查询脚本</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<style type="text/css">
/* GitHub stylesheet for MarkdownPad (http://markdownpad.com) */
/* Author: Nicolas Hery - http://nicolashery.com */
/* Version: b13fe65ca28d2e568c6ed5d7f06581183df8f2ff */
/* Source: https://github.com/nicolahery/markdownpad-github */

/* RESET
=============================================================================*/

html, body, div, span, applet, object, iframe, h1, h2, h3, h4, h5, h6, p, blockquote, pre, a, abbr, acronym, address, big, cite, code, del, dfn, em, img, ins, kbd, q, s, samp, small, strike, strong, sub, sup, tt, var, b, u, i, center, dl, dt, dd, ol, ul, li, fieldset, form, label, legend, table, caption, tbody, tfoot, thead, tr, th, td, article, aside, canvas, details, embed, figure, figcaption, footer, header, hgroup, menu, nav, output, ruby, section, summary, time, mark, audio, video {
  margin: 0;
  padding: 0;
  border: 0;
}

/* BODY
=============================================================================*/

body {
  font-family: Helvetica, arial, freesans, clean, sans-serif;
  font-size: 14px;
  line-height: 1.6;
  color: #333;
  background-color: #fff;
  padding: 20px;
  max-width: 960px;
  margin: 0 auto;
}

body>*:first-child {
  margin-top: 0 !important;
}

body>*:last-child {
  margin-bottom: 0 !important;
}

/* BLOCKS
=============================================================================*/

p, blockquote, ul, ol, dl, table, pre {
  margin: 15px 0;
}

/* HEADERS
=============================================================================*/

h1, h2, h3, h4, h5, h6 {
  margin: 20px 0 10px;
  padding: 0;
  font-weight: bold;
  -webkit-font-smoothing: antialiased;
}

h1 tt, h1 code, h2 tt, h2 code, h3 tt, h3 code, h4 tt, h4 code, h5 tt, h5 code, h6 tt, h6 code {
  font-size: inherit;
}

h1 {
  font-size: 28px;
  color: #000;
}

h2 {
  font-size: 24px;
  border-bottom: 1px solid #ccc;
  color: #000;
}

h3 {
  font-size: 18px;
}

h4 {
  font-size: 16px;
}

h5 {
  font-size: 14px;
}

h6 {
  color: #777;
  font-size: 14px;
}

body>h2:first-child, body>h1:first-child, body>h1:first-child+h2, body>h3:first-child, body>h4:first-child, body>h5:first-child, body>h6:first-child {
  margin-top: 0;
  padding-top: 0;
}

a:first-child h1, a:first-child h2, a:first-child h3, a:first-child h4, a:first-child h5, a:first-child h6 {
  margin-top: 0;
  padding-top: 0;
}

h1+p, h2+p, h3+p, h4+p, h5+p, h6+p {
  margin-top: 10px;
}

/* LINKS
=============================================================================*/

a {
  color: #4183C4;
  text-decoration: none;
}

a:hover {
  text-decoration: underline;
}

/* LISTS
=============================================================================*/

ul, ol {
  padding-left: 30px;
}

ul li > :first-child, 
ol li > :first-child, 
ul li ul:first-of-type, 
ol li ol:first-of-type, 
ul li ol:first-of-type, 
ol li ul:first-of-type {
  margin-top: 0px;
}

ul ul, ul ol, ol ol, ol ul {
  margin-bottom: 0;
}

dl {
  padding: 0;
}

dl dt {
  font-size: 14px;
  font-weight: bold;
  font-style: italic;
  padding: 0;
  margin: 15px 0 5px;
}

dl dt:first-child {
  padding: 0;
}

dl dt>:first-child {
  margin-top: 0px;
}

dl dt>:last-child {
  margin-bottom: 0px;
}

dl dd {
  margin: 0 0 15px;
  padding: 0 15px;
}

dl dd>:first-child {
  margin-top: 0px;
}

dl dd>:last-child {
  margin-bottom: 0px;
}

/* CODE
=============================================================================*/

pre, code, tt {
  font-size: 12px;
  font-family: Consolas, "Liberation Mono", Courier, monospace;
}

code, tt {
  margin: 0 0px;
  padding: 0px 0px;
  white-space: nowrap;
  border: 1px solid #eaeaea;
  background-color: #f8f8f8;
  border-radius: 3px;
}

pre>code {
  margin: 0;
  padding: 0;
  white-space: pre;
  border: none;
  background: transparent;
}

pre {
  background-color: #f8f8f8;
  border: 1px solid #ccc;
  font-size: 13px;
  line-height: 19px;
  overflow: auto;
  padding: 6px 10px;
  border-radius: 3px;
}

pre code, pre tt {
  background-color: transparent;
  border: none;
}

kbd {
    -moz-border-bottom-colors: none;
    -moz-border-left-colors: none;
    -moz-border-right-colors: none;
    -moz-border-top-colors: none;
    background-color: #DDDDDD;
    background-image: linear-gradient(#F1F1F1, #DDDDDD);
    background-repeat: repeat-x;
    border-color: #DDDDDD #CCCCCC #CCCCCC #DDDDDD;
    border-image: none;
    border-radius: 2px 2px 2px 2px;
    border-style: solid;
    border-width: 1px;
    font-family: "Helvetica Neue",Helvetica,Arial,sans-serif;
    line-height: 10px;
    padding: 1px 4px;
}

/* QUOTES
=============================================================================*/

blockquote {
  border-left: 4px solid #DDD;
  padding: 0 15px;
  color: #777;
}

blockquote>:first-child {
  margin-top: 0px;
}

blockquote>:last-child {
  margin-bottom: 0px;
}

/* HORIZONTAL RULES
=============================================================================*/

hr {
  clear: both;
  margin: 15px 0;
  height: 0px;
  overflow: hidden;
  border: none;
  background: transparent;
  border-bottom: 4px solid #ddd;
  padding: 0;
}

/* TABLES
=============================================================================*/

table th {
  font-weight: bold;
}

table th, table td {
  border: 1px solid #ccc;
  padding: 6px 13px;
}

table tr {
  border-top: 1px solid #ccc;
  background-color: #fff;
}

table tr:nth-child(2n) {
  background-color: #f8f8f8;
}

/* IMAGES
=============================================================================*/

img {
  max-width: 100%
}
</style>
</head>
<body>
<h1>linux网络相关查询脚本</h1>
<hr />
<h2>1.查看tcp链接状态（功能相似）</h2>
<pre><code>netstat -nat |awk '{print $6}'|sort|uniq -c|sort -rn
netstat -n | awk '/^tcp/ {++S[$NF]};END {for(a in S) print a, S[a]}' 或
netstat -n | awk '/^tcp/ {++state[$NF]}; END {for(key in state) print key,&quot;\t&quot;,state[key]}'
netstat -n | awk '/^tcp/ {++arr[$NF]};END {for(k in arr) print k,&quot;\t&quot;,arr[k]}'
netstat -n |awk '/^tcp/ {print $NF}'|sort|uniq -c|sort -rn
netstat -ant | awk '{print $NF}' | grep -v '[a-z]' | sort | uniq -c  
netstat -nat | grep &quot;172.16.32.165:22&quot;|awk '{print $5}'|awk -F: '{print $1}'|sort |uniq -c| sort -nr
ss state all| awk '{++S[$1]} END {for (a in S) {printf &quot;%11-s %s\n&quot;, a,S[a]}}' 
</code></pre>

<h2>2.查找请求数前20个的IP</h2>
<pre><code>netstat -anlp|grep 80|grep tcp|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -nr|head -n20
netstat -ant |awk '/:80/{split($5,ip,&quot;:&quot;);++A[ip[1]]}END{for(i in A) print A[i],i}' |sort -rn|head -n20   
</code></pre>

<h2>3.用tcpdump嗅探80端口谁的访问量最高</h2>
<pre><code>tcpdump -i eth0 -tnn dst port 80 -c 1000 | awk -F&quot;.&quot; '{print $1&quot;.&quot;$2&quot;.&quot;$3&quot;.&quot;$4}' | sort | uniq -c | sort -nr |head -20
</code></pre>

<h2>4.查看80端口连接数</h2>
<pre><code>netstat -nat|grep -i &quot;80&quot;|wc -l
</code></pre>

<h2>5.对连接的IP按照连接数量排序</h2>
<pre><code>netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
</code></pre>

<h2>6.查找较多的<code>time_wait</code>连接</h2>
<pre><code>netstat -n|grep TIME_WAIT|awk '{print $5}'|sort|uniq -c|sort -rn|head -n20
</code></pre>

<h2>7.查找较多的SYN连接</h2>
<pre><code>netstat -an | grep SYN | awk '{print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -nr | more
</code></pre>

<h2>8.根据端口列进程</h2>
<pre><code>netstat -ntlp | grep 80 | awk '{print $7}' | cut -d/ -f1
</code></pre>

<h2>9.查看有多少个php-cgi进程活动</h2>
<pre><code>netstat -anp | grep php-cgi | grep ^tcp | wc -l
</code></pre>

<h2>10.查看php-cgi占用内存总数</h2>
<pre><code>total=0; for i in `ps -C php-cgi -o rss=`; do total=$(($total+$i)); done; echo &quot;PHP-CGI Memory usage: $total kb&quot;
</code></pre>

<h2>11.获取最常用的10个命令</h2>
<pre><code>history | awk '{CMD[$2]++;count++;}END { for (a in CMD)print CMD[a] &quot; &quot; CMD[a]/count*100 &quot;% &quot; a;}' | grep -v &quot;./&quot; | column -c3 -s &quot; &quot; -t | sort -nr | nl | head -n10
</code></pre>

<h2>12.常用网络命令介绍</h2>
<ul>
<li>
<p>ping：通过ICMP回应/回复报文来检查远端主机的端到端连接性（RTT延时，抖动，丢包）。用来检查系统状态和可连接性很不错。  
</p>
</li>
<li>
<p>hping：网络扫描和检测工具，可以产生ICMP/TCP/UDP ping数据包。常常用于高级端口扫描，防火墙测试，手动MTU路径发现和碎片测试。  
</p>
</li>
<li>
<p>traceroute：通过TTL限定的ICMP/UDP/TCP侦测包来发现从本地主机到远端目标主机之间的第三层转发路径。用来调试网络连接性和路由问题。  
</p>
</li>
<li>
<p>mtr：traceroute的一个变种，能根据运行时统计数据整理出每一跳的包丢失/抖动。用来评估路由路径延时很不错。  
</p>
</li>
<li>
<p>netcat/socat：可以读/写 TCP/UDP 协议字节流。</p>
</li>
<li>
<p>dig：DNS调试工具，可以生成正向查询，反向查询，搜索域名服务器，检查CNAME，MX和其他DNS记录。可以在侦错的时候查询特定的DNS服务器。</p>
</li>
<li>
<p>nslookup：另外一个DNS检查/调试工具。支持所有DNS查询和记录。可以查询特定DNS服务器。</p>
</li>
<li>
<p>dnsyo：一个DNS测试工具，通过对全世界1500个不同网络中的大量开放解析器执行DNS查询来测试DNS传输。</p>
</li>
<li>
<p>lsof：显示进程打开的文件信息（例如，普通文件，管道或套接字）。</p>
</li>
<li>
<p>iftop：一个基于ncurses的命令行界面应用，可以实时监视各个网络物理接口上的网络连接和带宽占用。用来记录霸占带宽的应用、用户、目的地和端口等很不错。</p>
</li>
<li>
<p>netstat：一个网络统计工具，可以显示状态以及统计信息，当前网络连接（TCP/UDP端口，IP地址）、路由表、TX/RX traffic以及网络协议。用来做网络相关诊断和性能调试很不错。</p>
</li>
<li>
<p>ip：一个多功能的命令行网络工具，是iproute2包的一部分。可以检查和修改路由表、网络设备状态以及IP隧道设置。用来查看路由表、增加/删除静态路由、配置网络接口、以及调试路由问题很有用。</p>
</li>
<li>
<p>ifup/ifdown：用来激活和关闭特定的网络接口。经常用于重启整个网络服务。</p>
</li>
<li>
<p>autossh：一个能建立SSH连接并在断线后自动重新连接的程序。用来创建长时间保持的穿越严格企业网络的SSH隧道很有用。</p>
</li>
<li>
<p>iperf：一个网络测试工具，通过在发送自定义TCP/UDP数据流来衡量主机间双向最大吞吐量。</p>
</li>
<li>
<p>elinks/lynx：为基于命令行的服务器环境下使用的基于文字的网页浏览器。</p>
</li>
</ul>

</body>
</html>
<!-- This document was created with MarkdownPad, the Markdown editor for Windows (http://markdownpad.com) -->
